Benchmark: Dompurify vs sanitize-html (latest)

HTML Preparation code:

<script src="https://cdn.jsdelivr.net/npm/sanitize-html/dist/sanitize-html.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/dompurify/dist/purify.min.js"></script>

Tests:

DOMPurify
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> `; const result = DOMPurify.sanitize(testString);
Sanitize HTML
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> `; const result = sanitizeHtml(testString);

Historical Performance Data aggregated from 16 community runs

Desktop Results:

Chrome 11 runs

Sanitize HTML

80K/s

DOMPurify

21K/s

Fastest: Sanitize HTML (3.8x faster)

View exact numbers

✓ Sanitize HTML: 79,596 ops/sec
• DOMPurify: 20,918 ops/sec

Firefox 5 runs

Sanitize HTML

56K/s

DOMPurify

12K/s

Fastest: Sanitize HTML (4.7x faster)

View exact numbers

✓ Sanitize HTML: 56,404 ops/sec
• DOMPurify: 12,016 ops/sec

Results show median performance across all community submissions. Run this benchmark yourself to verify on your device.

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
DOMPurify
Sanitize HTML

Fastest: N/A

Slowest: N/A

Latest run results:

Run details: (Test run date: 3 months ago)

User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0

Browser/OS: Chrome 146 on Windows

View result in a separate tab

Sanitize HTML

80K/s

DOMPurify

18K/s

View exact numbers

Test name	Executions per second
✓ Sanitize HTML	79,596 Ops/sec
DOMPurify	17,904 Ops/sec

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

LLMs can make mistakes. Check important info.

Let's break down the provided JSON data and explain what's being tested, compared, and considered.

**Overview**

The benchmark measures the performance of two HTML sanitization libraries: `sanitize-html` (Sanitize HTML) and `DOMPurify`. The test cases are designed to evaluate the speed and efficiency of these libraries in cleaning up malicious input strings.

**Options Compared**

Two options are being compared:

1. **Sanitize HTML**: This library uses a regex-based approach to remove unwanted characters, tags, and attributes from HTML input.
2. **DOMPurify**: This library uses a more advanced algorithm that analyzes the input string's structure and removes malicious elements, such as script tags, links with JavaScript code, and inline event handlers.

**Pros and Cons of Each Approach**

* **Sanitize HTML**
	+ Pros:
		- Simple and efficient implementation
		- Effective against simple attacks (e.g., removing script tags)
	+ Cons:
		- May not catch more complex attacks (e.g., JavaScript code embedded in attributes)
		- Can be slow for large input strings due to regex overhead
* **DOMPurify**
	+ Pros:
		- More comprehensive and effective against complex attacks
		- Optimized for performance, reducing execution time
	+ Cons:
		- More complex implementation, potentially slower than Sanitize HTML
		- May require more memory to process input strings

**Library Descriptions**

1. **sanitize-html**: A lightweight JavaScript library developed by Michael D. Catanzaro. Its purpose is to sanitize user-inputted HTML to prevent cross-site scripting (XSS) attacks.
2. **DOMPurify**: Developed by Ted Goode, DOMPurify is a popular JavaScript library designed to clean up malicious input strings, removing unwanted tags, attributes, and content.

**Special JavaScript Features or Syntax**

The test cases use some special JavaScript features:

1. **Template literals**: The `testString` variables are created using template literals, which allow for string interpolation with JavaScript expressions.
2. **JavaScript code embedded in HTML**: Some of the input strings contain JavaScript code embedded in attributes (e.g., `<img src=x onerror=console.log(1)>`). This demonstrates a common XSS vulnerability.

**Other Alternatives**

If you're interested in exploring other options, consider the following:

* **js-sanitize**: Another lightweight JavaScript library for HTML sanitization.
* **html-purer**: A more comprehensive library that also removes comments and styles from input strings.
* **XSS filter**: Some web frameworks and libraries, like Node.js's built-in XSS filter, provide built-in protection against XSS attacks.

Keep in mind that this benchmark is focused on the performance of specific libraries, but there are other considerations when evaluating HTML sanitization solutions, such as security, feature set, and ease of use.

Dompurify vs sanitize-html (latest) (version: 0)

Comparing performance of: `DOMPurify vs Sanitize HTML`

Created: one year ago by: Guest

Go to the latest result

DOMPurify

Sanitize HTML

Historical Performance Data aggregated from 16 community runs

Desktop Results:

Chrome 11 runs

Firefox 5 runs

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

Dompurify vs sanitize-html (latest) (version: 0)

Comparing performance of: DOMPurify vs Sanitize HTML

Created: one year ago by: Guest

Go to the latest result

DOMPurify

Sanitize HTML

Historical Performance Data aggregated from 16 community runs

Desktop Results:

Chrome 11 runs

Firefox 5 runs

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

Related benchmarks

Comparing performance of: `DOMPurify vs Sanitize HTML`